From: Juergen Gross Date: Tue, 13 Sep 2022 05:35:13 +0000 (+0200) Subject: tools/xenstore: fix deleting node in transaction X-Git-Tag: RELEASE-4.14.6~80 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=fd44be9ccb0b8704497498e45e020738a11d27e3;p=xen.git tools/xenstore: fix deleting node in transaction In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. This is part of XSA-421 / CVE-2022-42325. Signed-off-by: Juergen Gross Tested-by: Julien Grall Reviewed-by: Julien Grall (cherry picked from commit 13ac37f1416cae88d97f7baf6cf2a827edb9a187) --- diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c index cd592845e7..6297149986 100644 --- a/tools/xenstore/xenstored_transaction.c +++ b/tools/xenstore/xenstored_transaction.c @@ -424,7 +424,13 @@ static int finalize_transaction(struct connection *conn, true); talloc_free(data.dptr); } else { - ret = do_tdb_delete(conn, &key, NULL); + /* + * A node having been created and later deleted + * in this transaction will have no generation + * information stored. + */ + ret = (i->generation == NO_GENERATION) + ? 0 : do_tdb_delete(conn, &key, NULL); } if (ret) goto err;